Heap-based Buffer Overflow in F Prime Framework by NASA

CVE-2026-92159

What is CVE-2026-92159?

The F Prime framework, a tool used for developing and deploying spaceflight embedded software applications, exhibits a vulnerability in its telemetry packet handling mechanism. Specifically, the 'Svc::TlmPacketizer TlmRecv_handler' functions permit an attacker to exploit a fixed-slot copy mechanism that does not validate the size of incoming data. When a telemetry update with data exceeding the allocated channel size is processed, it results in adjacent memory corruption, potentially leading to the emission of erroneous telemetry data. This flaw has been rectified in version 4.3.0, enhancing the integrity of the telemetry updates managed by the F Prime framework.

References